[Tracker] AeroFTP 4.2.5 - Known issues, patches & updates

[axpnet]

AeroFTP 4.2.5, Rolling Tracker

Known issues, requested work and completed changes for the next release. Released as AeroFTP 4.2.5; the open requests continue in #1424.

What shipped in 4.2.4

Native Proton Drive, headless saved-profile authorization, bounded Proton CLI bulk transfers, scoped cross-profile authentication and overlays, safer transfer recovery and archive publication, desktop integration repairs and updates across all 47 languages. See the 4.2.4 release notes and previous tracker #1202 for the completed cycle. Broader wrapper performance work remains open in Requested 71; MEGAcmd and Filen bulk are not implemented.

Patches & updates queued for 4.2.5

Shipped in v4.2.5.

#	Type	Change	Status	Commit	Ref
1		Anthropic OSS Scanner enrollment: build image and scanner-facing threat model. .oss-scanner/Dockerfile (Ubuntu 24.04, Node 24, Rust 1.97.1, offline-ready locked graph, compiled test harness, credential/grant smoke regressions), Dockerfile.dockerignore and threat_model.md deferring to docs/THREAT-MODEL.md. Verified with Anthropic's own tools/check aeroftp against main in 13 minutes (45 budget). Enrollment PR open, all checks green: anthropics/oss-scanner#935.	✅	01e27235c	#1319
2		webpki stack bumped for RUSTSEC-2026-0381/0382/0383 (distrusted emSign intermediates): rustls-webpki 0.103.15 to 0.103.16, webpki-roots and webpki-root-certs 1.0.9 to 1.0.10. Cargo.lock only; cargo audit clean again, Checks on main green.	✅	4d87827ca	#1320
3		Security contact email in SECURITY.md: dev@aeroftp.app listed next to GitHub Security Advisories, matching the primary_contact of the OSS Scanner enrollment.	✅	2a1e45eb9	#1321
4		AeroSync Compare retains shared and empty remote folders and skips files that have already converged. Provider scans keep directory inventory, S3 implicit parents and typed rclone names; checksum, file/directory and unsettled-upload conflicts stay actionable. The inventory/baseline correction is on main for v4.2.5; the reporter's post-merge Unicode case remains separately tracked in #1326, with integrated-build confirmation pending.	✅	10e647da2	#1322, #1323
5		Recursive uploads preserve literal backslashes in Unix filenames and directories. put -r no longer aliases back\slash.txt to back/slash.txt, preventing skipped files or overwritten nested paths; only the platform's native separator is normalized, with pooled, single-session and guarded-mode regression coverage.	✅	4cc380297	#1324
6		Sync, watch and GUI preserve literal Unix backslashes without aliasing nested paths. Native scans and frontend transfers retain exact names, Windows drive/UNC roots remain navigable, remote upload parents are created with real error handling, and escaped ignore reinclusions remain reachable without traversing unrelated excluded trees. The scoped path repair is merged; Unicode correspondence and adjacent format contracts remain separate.	✅	917ef97a4	#1325, #1326
7		AeroSync matches canonical Unicode names while preserving each object's actual path and baseline identity. Exact siblings remain independent across compare, watcher events, transfers and resume; mapped renames avoid literal-name collisions, and plain SFTP navigation resolves destination spellings from listings. Includes the contribution from @bratushkadan; confirmation of the final integrated build on the original macOS/SFTP pair remains pending.	✅	2a5c5ed7d	#1328, #1326, #1329
8		The open compatible dependency updates are on main, including the AWS-LC, HTTP/2 and archive patches. Details.	✅	913e0b0d9	#1330
9		FTP resume and range reads keep their offset on servers that drop a REST sent too early, and a server without restart support is reported as such. Details.	✅	86bb1336b	#1331
10		English written in the code is now translated in every language: labels, card titles, badges, tooltips and screen-reader labels across AeroAgent, connection, settings, dialogs and panels, and the former-English ledger keeps strings from squashed branches. Details.	✅	d2b6109fb	#1333
11		CI: the apt install of the build stack survives a slow Ubuntu mirror, and its archive cache is saved even when the install fails, so a rerun resumes instead of starting over. Details. Cache eviction follow-up: Requested 76.	✅	0a3e15eaa	#1332
12		Proton Drive CLI mode reaches its native bulk from relative paths, sync trees, --no-clobber and MCP aeroftp_upload_many, and bulk downloads check the uploader's claimed size instead of the listed one. Details. Follow-ups: Requested 77 to 79.	✅	dcaba8688	#1334
13		Proton Drive native downloads no longer load each file again before reading it, put -r settles its target folder in one request, and the CLI unlocks the vault once per command. Details. Follow-ups: Requested 81 to 83.	✅	a740db430	#1335
14		CI keeps one Rust cache per job family instead of one per job, and runs on main are no longer cancelled by the next merge. Details. Requested 61 closed on measurement; Requested 76 stays open until the quota is checked.	✅	3998c7b7f	#1336
15		Activity panel lines, toasts and error states that the views wrote in English are now translated in every language, and the Activity panel no longer shows three raw keys. Details.	✅	dbf3fe3fa	#1337
16		FTP servers without restart support get the whole file instead of failing every resume or parallel download, and names with CR or LF are refused before any command. Details. Closes Requested 73, 74 and 75.	✅	6baea23b0	#1339
17		MCP aeroftp_upload_many honours its batch no_clobber and delay_ms again, and a first sync into a folder that does not exist yet ends clean instead of partial. Details. Closes Requested 78 and 80.	✅	a7cf592c5	#1338
18		In-place partial downloads restart from byte 0 instead of joining an unverified old prefix to the current source, and local downloads refuse their own source before truncating it. Details. Closes Requested 45.	✅	152094cae	#1342 (Requested 45)
19		Proton Drive native commands reach their first Drive request two round trips sooner: My Files is asked with the account keys and the root folder comes from its answer. Details. Follow-ups: Requested 81 and 88.	✅	b1645375c	#1340
20		Recursive walks refuse the B2 bucket root, skip internal upload symlinks, resolve absolute GitLab paths from the repository root and keep distinct FUSE child inodes. Details. Requested 54 points 1-4 are fixed; points 5-6 remain open.	✅	211751847	#1343 (Requested 54, points 1-4)
21		cargo audit passes on main again: ctutils moves past RUSTSEC-2026-0385 and the yanked clipboard-win is replaced. Details.	✅	cfc1109e0	#1344
22		The community benchmark measures latency as signal bars, recommends the best service and protocol from your own network, and a run stops and cleans up on Ctrl+C or its timeout. Details.	✅	5cdfb4b5e	#368, #1341, Requested 6 (CLI part)
23		English reached through names, states, props and other modules is now translated in every language, and the rendered-English test follows those paths (Requested 84 part B). Details.	✅	3cac7929d	#1345
24		Proton Drive native downloads keep ten blocks in flight across revision pages, and five files or folder scans run at once, in the CLI and the GUI. Details. Closes Requested 82 and 83.	✅	bc49a1187	#1346
25		A MEGAcmd 2.6 WebDAV profile saved at the bridge root connects to the path MEGAcmd serves and can create folders again, and a WebDAV listing no longer shows a base with escapes in its path as an entry of itself. Details.	✅	5699a0b56	#1348, Requested 87
26		English passed to t() as an interpolation parameter is now translated in every language, and the rendered-English test checks those values (Requested 84 part C). Details. With parts A (#1337) and B (#1345), closes Requested 84.	✅	9c3f7f429	#1347
27		Recursive walks report a scan that stopped early as partial, and map entries through the root spelling each provider uses, so downloads, Properties, Compare and the sync diagnostics build the right names and never drop a loop back to the root silently. Details.	✅	e781b63e3	#1349, Requested 54
28		A Windows portable update installs the app at the launch path, never the CLI, also when updating from 4.0.8 to 4.2.4; an interrupted update keeps an exe there, and the CLI executables are updated too from the update after this one. Details.	✅	e6a5161ba	#1351, Requested 60
29		Proton Drive CLI mode opens in My Files like the native client, and switching a profile between the two moves its initial folder, AeroCloud folders and sync histories to the other spelling. Details.	✅	a1fec6847	#1352, Requested 79
30		Every counted label reads right for any number in every language: plural forms fixed in the eleven languages with more than two, numbers no longer glued to a word translated on its own, and a test that keeps the shape out. Details. Closes Requested 89.	✅	473b8ff72	#1354
31		The benchmark labels Proton's two clients right, leaves nothing in the trash on Proton's CLI and after the many-files workload where the provider allows it, and says so in the report when it cannot, as on Koofr. Details.	✅	1731978ad	#1353, Requested 92, Requested 94
32		Provider probes distinguish confirmed missing paths from refused requests, unreadable metadata and incomplete listings, with protected GUI, CLI and MCP writes using verified checks or native create-only guards. Details. Closes Requested 47.	✅	9ce9b35f1	#1350, Requested 47
33		A CLI test that read a download part before its write landed no longer fails on a loaded runner. Details.	✅	96897bd55	#1356, Requested 95
34		cargo audit is green again after RUSTSEC-2026-0387: crypto-bigint 0.7 moves to 0.7.6, and the 0.5.5 copy that no release can replace yet is a documented exception. Details.	✅	097a35bed	#1355
35		The benchmark's "Best protocol per service" names a protocol only when two different protocols of the service measured that figure, so a cache or local client no longer hands the latency to the only one measured. Details.	✅	bf8a15038	#1361
36		On Proton Drive in CLI mode the benchmark purges the files its many-files workload deleted from the trash, each by a name it made unique for the run and checked against the UID captured before the delete, and aeroftp_benchmark runs over MCP again. Details.	✅	00110ec40	#1362, Requested 94
37		AeroSync and AeroCloud send the files of a run on the provider's native bulk: on Proton Drive in CLI mode one start of the official program per folder instead of one or two per file. Details.	✅	7f0faeb97	#1360, Requested 77
38		A failed HTTP or SFTP download settles its part before returning, and a retry in the same process waits for the abandoned attempt, so it resumes or starts again at once on every surface, Windows included. Details.	✅	d7d6da13b	#1357, Requested 95
39		The Windows portable build keeps its log in data\logs of its own folder, never on the host, and starts even when that log cannot be opened; the diagnostic bundle and the MCP debug snapshot read the real AeroFTP.log on every platform. Details.	✅	ddb45dd8d	#1358, Requested 96
40		A folder download starts its files while the scan is still running, in the CLI (get -r) and the GUI, on every provider where each file runs on a session of its own. Details.	✅	b77745b1c	#1363, Requested 81
41		A GUI folder download refuses two entries that would land on one local file (duplicate, sanitized, case-folded or cross-listing names) instead of silently overwriting the first, on the provider, legacy FTP/SFTP and live-batch paths, as the CLI does since #1349. Details.	✅	ec9964000	#1365, Requested 97
42		"Open with AeroFTP" on any file opens AeroFile on its folder with the file selected and previewed (AeroImage for pictures, the text preview for text), on Linux, Windows and macOS; on the Linux packages "Open with" works again, and a file or archive opened during startup is no longer dropped. Details.	✅	0afb61ee2	#1359, #347
43		A permanent delete on Google Drive no longer fails with "Trash search parse error" when the trash search finds nothing, and a matching trash item is found and purged, because the search now asks Drive for every field it needs. Details.	✅	54c5ad1ef	#1364, Requested 86
44		AeroSync keeps scan progress across Compare and Plan and gives the Transfer Queue a stable whole-plan denominator. Compatible template imports reuse the existing comparison, while changed scan filters still require a rescan for correctness. Details.	✅	aa160ea89	#1368, #347
45		Pre-release audit fixes: a WebDAV entry named like its folder is no longer dropped (bidirectional sync deleted its local copy), AeroCloud no longer uploads over a remote copy its scan could not see, the Proton Drive mode switch refuses a pending sync and colliding histories and rolls back fully, Open with no longer opens the old executable after a portable update, the portable banner no longer calls an installed AeroFTP's data folder leftover, and Proton Drive opens on the API tab from Add Service. Details.	✅	1846c3683	#1369
46		Pre-release audit fixes, second package: AeroSync again backs up a file it sends on its own, folder downloads in the GUI and the CLI refuse two remote files that would land on one local name (case and Unicode spellings included), the download folder probe never deletes an existing file, an incomplete scan is no longer reported as complete, and an unreadable FTP size is no longer shown as 0 bytes. Details.	✅	e5a2b9967	#1367
47		Renaming or moving a fresh upload on the Filen Desktop S3 preset now waits for publication instead of failing with a missing source, including on a new connection. Details.	✅	c67048947	#1371, Requested 91
48		The benchmark settles the eight points of the v4.2.3/v4.2.4 retest (picker columns, no authorization URL, trash notes, stopwatch and h/m/s durations, per-mode credentials for --all-protocols, one fallback warning per profile), and OneDrive follows shortcuts and shared folders for every operation. Details.	✅	24a54e1d9	#1370, Requested 99
49		Hashsum handles servers that ignore byte ranges with one checked full-download fallback; MCP and AeroAgent validate hash input lengths, and reconcile reports failed checksums separately with a partial verdict. Details.	✅	105373a08	#1373
50		AeroSync templates preserve Update and the other Plan settings across export and import, retain 4.2.4 defaults, reject invalid values, and use clear conflict-policy labels with an accurate Update description in all 47 languages. Details.	✅	a8214941c	#1372, #1366
51		A benchmark run or CLI speed test on Nextcloud or ownCloud now purges from the trash exactly the item it deleted, and nothing else; plain WebDAV and Koofr are unchanged. Details.	✅	0fb993d77	#1374, Requested 92 (Nextcloud part)
52		Diagnostics and the error text handed to AeroAgent, the CLI agent and MCP redact the whole Authorization value and every secret field form; the review findings left on merged pull requests are closed. Details.	✅	f61f2e400	#1375
53		The dependency audit is green again on main: crypto-bigint moved from a yanked 0.7.6 to 0.7.9 (lockfile only). Details.	✅	7650f6744	#1378
54		Windows portable: a dismissed banner stays dismissed after a reboot, settings stored in the vault apply at startup, and the portable build no longer changes the installed app's startup entry. Details.	✅	4b9de0814	#1376, #1377
55		App settings stay in the encrypted vault: no plaintext copy in WebView storage (readable while locked since 4.2.3), one migration instead of a rewrite at every start, and no write from a vault that is not ready. Details.	✅	31456da18	#1379
56		Snap security refresh reads architecture-qualified staged packages again, so the weekly audit reaches its rebuild decision instead of rejecting the published manifest; mismatched architectures still fail closed. The real published Snap audit covers all 188 packages.	✅	42ff449f2	#1380
57		Internal v4.2.3 triage and verification notes are removed from the public documentation. Details.	✅	6b7a0162f	#1381
58		Both TLS trust stores remove two additional emSign roots, alongside compatible Vite, react-window, uuid and Unicode normalization updates. Five Dependabot PRs are consolidated into one reviewed bundle. Details.	✅	9a8112f55	#1387
59		CLI check --checksum now requests remote hashes as well as local hashes, detecting different same-size contents when the provider supplies comparable SHA-256. JSON identifies pairs using the size fallback. Details.	✅	952752600	#1388
60		Crypt connections open directly at the resolved Remote Path; a separate encrypted scope stays locked until entered, with fresh reconnect state and an outside-scope Filen listing that survives Refresh. Details.	✅	d6552d74c	#1390
61		AeroFTP4.2.5 preparation aligns public repository documentation and version declarations with the implementation, completes Crypt activation ownership recovery and consumes AeroVault0.6.7. Final pre-tag audit, remaining security work, main CI and synchronized publication remain release gates. Details.	✅	477b81a7d	#1391
62		Reject remote download names that could escape the selected local directory before preflight and writes, while preserving literal backslashes on POSIX destinations across single, folder, batch and retry paths.	✅	28c61059a	#1392
63		S3 server-side copies retain the destination profile encryption policy and AeroCloud forwards its saved SSE settings; configured ACL and storage class follow the shared upload policy, with the existing MegaS4 exclusion preserved.	✅	3eb1107e8	#1393
64		Filen share-link creation is refused for files and folders until per-share encryption exists; revoking existing links keeps working. Details.	✅	54f4434e8	#1395
65		The peer transport crate's standalone lockfile now uses the same patched TLS, certificate and async runtime versions as the application. Details.	✅	67db59003	#1397
66		S3 multipart copies refuse a plan over the 10,000-part limit before allocating it. Details.	✅	fd1a6c341	#1399
67		S3 virtual-hosted buckets can no longer redirect a signed request off the configured endpoint, and the plain-HTTP check follows the final request URL. Details.	✅	ca21375f1	#1398
68		Internxt in-memory downloads stage decrypted data in a private directory that is always removed, and a failed removal is reported. Details.	✅	f26af92d3	#1400
69		With several users on one device, credentials stay with the user who owns them: locked users fail closed, the legacy owner is fixed, and OAuth and Jottacloud tokens never cross users. Details.	✅	1dcb419f6	#1394
70		Pre-tag commit audit: PASS. Every 4.2.5 commit was reviewed and every confirmed finding is fixed on main; three follow-ups move to 4.2.6. Details.	✅	764bd0b39	#1401

Requested / under consideration

Community requests and follow-ups being evaluated for this or a later release. Unresolved rows carried forward from #1422, retaining their original numbers. The numbers stay the same across the three tables, so a reference such as "Requested 71" still means that row. The colored square is difficulty, not severity.

Features and ideas

New behaviour and product ideas. Not defects.

#	Difficulty	Type	Item	Status	Ref
1	🟧		Eager-evaluation preview and a single-vs-multi-target placeholder for the -i selectors (prioritised by the reporter ahead of Edit(E) and the 2-letter semantics; exact behaviour to be pinned)	🔵 idea	#311 (@EhudKirsh)
2	🟥		Lossless .jpg to .jxl transcode in AeroFile: JXL re-encodes an existing JPEG losslessly and reversibly (the original JPEG bytes reconstruct exactly), for a real size win with no quality loss. Candidate framing: AeroFile as a GUI for libjxl	🔵 idea	aerovault#2 (@EhudKirsh)
3	🟥		macOS shell integration for the OS extract feature (Deliverable G macOS, deferred): Finder Sync "Extract Here / Extract to Folder" menu items mirroring the Linux Nautilus and Windows verbs, plus macOS custom document-type icons (CFBundleDocumentTypes) for the five aero formats and the generic fallback, and rebuilding the mimetype .icns multi-size (the v4.1.0 ones are single-resolution drafts). Needs a Mac to build and live-test	🔵 planned	#1408 (Deliverable G)
4	🟥		Filen Encrypted Notes: exit Beta: take Filen Notes out of Beta. Fix the participants/add contactUUID format (currently a best-effort workaround), investigate the Filen free-plan 10-note limit ghost-note cleanup, and add a rich text editor for the rich note type	🔵 planned	-
6	🟥		Recommended-protocol highlight on the Add Service / Quick Connect pages, from the user's own benchmark (#368). The recommendation itself shipped in the CLI benchmark (Queued 22: "From this network" and "Best protocol per service", with latency as signal bars); what is left is showing it in the GUI next to each service and protocol.	🔵 idea	#274 (@EhudKirsh)
26	🟨		MCP client presets v1.1: Fetch and Git servers fetched at install time (the remote DeepWiki preset shipped in #1038): download pinned release artifacts when the user installs the preset, checked by SHA-256, gated by target OS and architecture and by the Python ABI, instead of embedding third-party archives in the app. Parked until after v4.2.2 for a design review of the supply-chain path.	🔵 planned	#1038
34	🟨		One speed and benchmark engine for GUI, CLI and MCP: today there are four (GUI speed test, CLI speed, speed-compare and benchmark; MCP runs the CLI). The GUI speed test covers only FTP, FTPS, SFTP, S3 and WebDAV, integrity check and score exist only in the GUI, and labels and defaults differ between them.	🔵 idea	#368
41	🟧		Tailwind CSS 4 migration: adopt its dedicated Vite or PostCSS plugin, migrate configuration and utilities, verify the main/extract/approval windows and define supported WebView versions. Separate task requested by the owner; v4 needs Safari 16.4+, while the macOS manifest currently declares 10.13.	🔵 planned	-
62	🟨		SFTP downloads against Windows SFTP servers: the read-ahead on its own channel (#1252), the shared read-ahead budget (#1260) and the 8 MiB channel window (#1261) are verified on seven Linux SFTP servers in Docker, on the NAS and from the GUI, not yet on Cerberus, Bitvise and Win32-OpenSSH. Verification against those Windows servers remains pending. Optional: a check of #1261 on a real long fat WAN path. Follows Requested 37 (SFTP download follow-ups), closed by #1252, #1260 and #1261.	🔵 planned	#1252, #1260, #1261
85	🟧		Choose what a profile import does with profiles that already exist: Skip, Overwrite or Duplicate. Today both the CLI profile-import ("existing profiles are SKIPPED, never overwritten") and the GUI import (ExportImportDialog.tsx, merge that skips the same id) only skip, so a backup cannot refresh the tokens or password of a profile that is already there; the workaround of deleting the profile first also drops it from favourites. Overwrite must replace the per-protocol secrets (#215) and the OAuth or Jotta tokens, not only the configuration; Duplicate gives a new id and a suffixed name. Importing a Jotta refresh chain onto a second machine breaks the first one, since the chain rotates on every connection: the import must say so. Requested by the owner.	🔵 planned	-
88	🟥		Proton native: a node cache kept current by Drive events. The official CLI keeps the decrypted nodes on disk and updates them from Drive events, so it lists a folder with one request; the native client asks for the details of every folder it lists (two requests per level). About 1.2 s on a 6-level tree at 150 ms per request, most of what still separates the two on deep trees. Ties in with event-based sync for AeroCloud.	🔵 idea	#1340
100	🟥		One-way Update with deletes, equivalent to rclone sync --update. Add a Mirror option that skips a newer destination instead of overwriting it while still deleting destination-only files; define how this combines with delete propagation and implement it consistently in the AeroSync GUI, CLI sync and AeroCloud for 4.2.6.	🔵 planned	#347 (@EhudKirsh)
101	🟧		AeroSync scheduling from My Servers and Add Service. Add AeroSync entry points to both screens, a global table of scheduled syncs in a revised Scheduler tab, and scheduling even when the current plan has no actions, for 4.2.6.	🔵 planned	#347 (@EhudKirsh)

Non-blocking fixes

Improvements and defects that do not block a release: follow-ups, measurements, and fixes with a contained effect.

#	Difficulty	Type	Item	Status	Ref
8	🟧		S3 recursive delete pays one extra HEAD per directory, because it lists with the trailing-slash prefix, which by construction cannot see the same-named key, so a separate probe is unavoidable given that listing. Listing with the slashless prefix would skip the probe entirely in the common case, where no same-named object exists, at the cost of a filter that must keep exactly path and path/.... The trap is the one #764 just closed, moved by one character: a sibling like reportsX also matches the shorter prefix. Whoever takes this must write both doors before the change, not after: reportsX survives a delete of reports, and reports survives when it is a real non-empty file. Worth doing when someone measures a slow recursive delete on a tree with many folders, not before. 4.2.1 context: #979 changed folder-removal semantics (a folder is removed only once empty, sync --delete removes the directories it emptied on every backend) but did not touch this listing or its probe; still open.	🔵 idea	#764
11	🟧		An HTTP 412 still does not distinguish a backend refusing If-Match from a source replacement. CLI fallback notices now ship in #1212 and #1216, so the missing fallback explanation from the original report is resolved. Backend diagnosis remains open: the client still cannot tell an incompatible gateway from an object that really changed.	🔵 planned	#885
12	🟧		A replacement that is slow and still in progress can pass the reading that decides whether to publish. That reading retries once; if the server is still writing the new version, the second reading can see an intermediate state. Neither the unit test nor the live reproduction covers it, because both replace in one write.	🔵 planned	#885
15	🟨		The same question has not been asked of parallel uploads. Azure, Box, Drime and Dropbox assemble parts read from the local file concurrently; whether a local file changing under them produces the mixture the download path had is an open question, not a finding.	🔵 planned	-
18	🟧		Flatpak vault migration after the GUI has initialized its sandbox vault: the current import deliberately skips a sandbox that already has any vault file, so that migration still needs its scope defined. Import into a vault-free sandbox, atomic copying of all three vault files, rollback, and JSON vault.db handling already shipped in #987, with a passing JSON-import regression test rechecked during the 4.2.3 triage.	🔵 planned	#961, #987
20	🟨		aerovault crate: zstd length handling. Deferred edge found while shipping the AeroCompress already-compressed skip.	🔵 planned	#925
21	🟨		Azure hierarchical-namespace folders: live test the directory-blob removal and HNS reporting against a real HNS account.	🔵 planned	#964
25	🟨		Line-ending follow-ups after the .gitattributes: drop the hand CRLF normalisations in the tray badge and checksum matrix tests once existing Windows development clones are refreshed, and move LICENSE to the LF rule only if the NSIS license page is shown to render LF text correctly on Windows.	🔵 planned	#1051
36	🟨		Live checks still owed on 4.2.2 changes: rounded window corners under the snap's X11 session, KWin, the NVIDIA driver, Flatpak and AppImage (fallback AEROFTP_SQUARE_CORNERS); Compare against a Digest WebDAV server; Stop, F4 and a disconnect during a Compare scan in the GUI; the tables whose columns moved left; ImageKit renameFolder on the real API. Progress 2026-10-16: ImageKit rename, Digest Compare, Stop/F4/disconnect and the tables verified live; corners verified on the AppImage, the Flatpak's vanishing window fixed (queued rows 30, 31), the KWin one from #1249 fixed by queued row 36 (not run on KWin itself), snap checked 2026-10-17 on GNOME (rounded corners, window fully visible) after fixing why it did not start (known issue 1); merged PR #1258 preserves explicit WEBKIT_DISABLE_DMABUF_RENDERER=0, which restores rounded corners on the measured AMD/Intel native Wayland systems while the absent-variable default remains 1; broader NVIDIA, KWin and X11 corner checks remain open; the defects found on the way are queued rows 32 to 34, and the Debug Panel one is queued row 40.	🟡 investigating	#1076, #1080, #1074, #1073, #1064, #1262
46	🟧		A silent HTTP server can hold a CLI command for up to 30 minutes. HTTP providers keep a 1800 s read timeout and no per-request limit; #1164 fixed the error wording and classification, not the wait. Still to do: measure metadata calls on Nextcloud and bound them, give the OAuth 1 sign-in client a timeout, add a global CLI --timeout.	🔵 planned	#1164
49	🟧		Khmer translation: about 3800 strings not yet read. #1194 read and corrected the most damaged families (connection, protocol, Cryptomator, settings, common, the 500 most anomalous strings); the last block read was still about 10% broken, so the rest needs a full read.	🔵 planned	#1194
51	🟧		WebDAV Digest: parallel requests fail on a server that enforces nonce-count order. Parallel connections share one Digest challenge and their nonce counts arrive out of order; Apache with AuthDigestNcCheck On (not its default) refuses some: a Compare walk misses 56-70 of 331 folders, get/put --parallel 8 fail 27-36 requests, always reported (rc 4). Serial runs are clean.	🔵 planned	#1080
56	🟨		Linux DMA-BUF renderer: explicit override and default policy. Step 1 merged in PR #1258 (853003d44, queued row 48): GUI startup and dispatcher preserve explicit values; absent still defaults to 1. WebKitGTK 2.52.6 native Wayland comparisons on AMD Radeon 890M and Intel UHD630 pass Monaco/xterm, eight canvas modes and six shaders ON/OFF; ON improves page cadence and restores rounded corners after unmaximizing. OFF WebGL still records GPU activity. The owner retains the compatibility default; a different default and broader driver/backend coverage, including NVIDIA, remain under consideration.	🟡 investigating	#1258, #1254, #1249
58	🟨		Connecting a second saved profile from the servers screen leaves the previous session active while it connects, so the in-session readers that follow the active session (#1251) show the old connection for that moment. Deselecting it when the connect starts changes how Cancel behaves, which needs a decision.	🔵 planned	#1251
64	🟨		In the snap the unmounted partitions never appear, and eject and mount cannot work: lsblk cannot run inside the snap (measured in 4.2.3: Permission denied; snapd grants it through hardware-observe, read in its AppArmor snippets, not tried), and eject and mount call udisksctl, which would also need the udisks2 interface (read in code, not measured). Neither interface connects automatically. To decide: plug them, or read the same data another way, and say in the app why the list is empty. Found with #1263.	🔵 planned	#1263
71	🟧		Investigate remaining wrapper and local-gateway transfer performance: profile MEGAcmd and Filen Desktop S3/WebDAV, plus residual Proton CLI upload overhead, using release builds, matched credentials, concurrency, retry policy and cache state. Separate vault/process startup, metadata, connection reuse and transfer-engine scheduling from wire I/O; distinguish local acknowledgement from independently verified cloud completion. Evaluate batching only with owned-transfer cancellation, per-file terminal outcomes, partial-failure handling and safe file-level recovery. Proton CLI bulk in #1317 does not complete this wider investigation; no cross-provider parity claim is made.	🔵 planned	#1317
72	🟥		Preserve literal Unix filenames across sync/watch/GUI. The scoped native/IPC repair is merged in #1325 after #1324 fixed recursive put; exact literal/nested names, Windows roots, parent creation and escaped ignore traversal are covered. Adjacent vault/backup representations and provider-specific grammar contracts remain separately classified; canonical Unicode correspondence is merged in #1328, with final macOS/SFTP confirmation tracked in #1326.	🟡 adjacent contracts remain	#1325, #1326
76	🟧		CI: the Actions cache is saturated, so the apt archive cache added in #1332 is evicted within half an hour. Measured 2026-10-22: 10.14 of 10 GB in 10 entries, filled by the GB-sized Rust caches; on run 39827742722 one job restored a 71 MB apt set at 18:42 UTC and installed in 57 s, and 30 minutes later two jobs found no entry at all. To decide: smaller or fewer Rust cache entries (per-workflow keys, saving only on main, pruning stale ones), so the small caches that turn a slow mirror into a non-event survive. #1336 (3998c7b7f) merged: cache usage to be checked at 24 hours and after a week; if it stays above 10 GB, the next candidates are the macOS smoke build and windows-native.	🔵 planned	#1332, #1336
90	🟨		No CI job runs clippy on the Windows-only code. cargo clippy -D warnings runs on Linux (linux-validate, nightly telemetry, the aerorsync and proton-native lanes), so #[cfg(windows)] modules are compiled by the Windows build and unit-test jobs but never linted. A Windows run of cargo clippy --all-targets -- -D warnings on 2026-10-23 found 5 existing errors: filesystem.rs:1117, mtp/backend.rs:680, mtp/windows_wpd.rs:415 and :422, atomic_write.rs:774. Fix them and add a clippy step to a Windows job (or a --target x86_64-pc-windows-msvc check), so a Windows-only warning turns a PR red like any other.	🔵 planned	-
92	🟨		A benchmark run on Koofr leaves its folders in the Koofr trash, and says nothing. The Koofr provider lists and restores trash items but has no permanent delete, so delete_permanent answers as if there were no trash, and a run on Koofr (native or its WebDAV preset) leaves its run folders there. The API used today can only empty the whole trash, which would also remove items the run did not create. Look for a targeted purge in the Koofr API and implement delete_permanent with it, and check the same gap on the Filen API and the Nextcloud trashbin. Today the Koofr trash can be listed and restored only from the GUI: the CLI trash list covers Nextcloud and the MCP remote_trash tool covers S3. Found by the #277 benchmark run on 2026-10-23. Since #1353 (1731978ad) the run no longer says nothing: its report notes that the Koofr trash was not emptied and must be emptied from Koofr; the purge itself is what this row still needs. Checked on 2026-10-25: Koofr offers no way to purge a single trash item (below). Filen does (its API purges one file or folder by UUID), but AeroFTP has no model of the Filen trash yet: planned. Nextcloud does too: shipped in #1374 (Queued 51), a benchmark or CLI speed-test cleanup on Nextcloud and ownCloud now purges exactly the trash item it deleted. A request for a selective purge was sent to Koofr on 2026-10-25. ⏳ Waiting for Koofr: Koofr's API, its web app and its own client can only empty the whole trash, which would also delete items you removed yourself, so AeroFTP will not use it. Until Koofr offers a way to delete one item from the trash, a benchmark run on Koofr (native or over WebDAV) leaves its run folders there and says so in its report; empty the Koofr trash from Koofr when you are ready (Koofr does not count the trash against your quota).	🔵 planned	#1341, #1353, #1374
93	🟧		Two profiles that sync the same pair of folders share one sync history. The sync index and the resumable journal are keyed by the local and remote folders only, so a second profile on another server that syncs the same pair overwrites the first one's baseline, and on main reads it as its own. #1352 (open) records the profile in each history and refuses another profile's, which turns the worst case into a lost baseline; the remaining fix is one history per profile, which renames every history file (CLI sync, AeroCloud, journals, the History dialog, the Proton mode switch). Found by the review of #1352.	🔵 planned	#1352
98	🟩		Proton Drive CLI 0.9.0 addresses trash items by name only, although its help says node UIDs can be used in paths. filesystem info and filesystem delete on /trash/<uid> answer "Trashed node not found"; in the official source getTrashedNode in cli/src/cli/paths.ts compares names only, while UID recognition exists for live paths. AeroFTP therefore purges a trashed item by name only when exactly one entry has that name and its UID is the expected one (Requested 94). To do: report it upstream (recognize UIDs in the trash resolver, or document the limit), and switch to UID addressing once a CLI release supports it. Found on 2026-10-24 during the live run of Requested 94.	🔵 planned	ProtonDriveApps/sdk
104	🟨		S3 version listings should keep reporting progress across pages: long object-version listings fetched page by page do not report steady progress. Found by the Deep Scan before 4.2.5, deferred by the owner to 4.2.6.	🔵	#1423

Higher-severity defects

Crashes, data loss, wrong file contents, or a security exposure. A row marked ⏳ waits on a step outside our code (an upstream release, or a crash we can trace); its note says what it waits for and what it means for you.

#	Difficulty	Type	Item	Status	Ref
5	🟥		Linux tray/GTK heap corruption, still-uncovered off-main-thread corruptor. A GDBus worker aborts with malloc(): unaligned fastbin chunk detected, the classic GLib heap-corruption signature, and it is the victim rather than the corruptor. Two marshalling fixes shipped in v4.0.5 and the SIGABRT still recurs with an identical signature, so the marshalling is incomplete and the remaining suspects are the event and plugin callbacks whose thread context is unconfirmed. Details. ⏳ Waiting for a crash we can trace: it is rare and so far seen only on development machines, with no report from users. If AeroFTP on Linux ever closes by itself with this message, please open an issue with the log: that is what lets us find the cause.	🟡 investigating	-
27	🟧		AppImage runtime with 0700 extraction folders: rechecked 2026-10-24: no dated type2-runtime release after 20251108 contains upstream 8f39b89e2 (#152); only continuous does (rebuilt 2026-10-19 at fedfad51a). Keep runtime 20251108 and its digest until a qualifying dated release exists; extracted runs still create folders 0755. Upstream #157 (open) restores the stored directory modes that #152 changed for --appimage-extract, and dated releases are requested in #140 (open since 2025-12). ⏳ Waiting for an upstream release: the fix already exists in the AppImage runtime and ships here as soon as a dated release contains it. Until then only the AppImage is concerned, and only when it is extracted instead of mounted (no FUSE, or --appimage-extract): its temporary folders can be read by other local users but not changed. The other packages do not use this runtime.	🔵 planned	#1072, #1104
102	🟧		AeroAgent archive creation checks sensitive-path rules only on the folders it was given: files nested deeper should be checked one by one before they are read into the archive. Found by the Deep Scan before 4.2.5, deferred by the owner to 4.2.6 as accepted debt.	🔵	#1423
103	🟧		MCP recursive sync checks sensitive-path rules only on the root it was given: every file and folder below it should be checked before it is read, written or deleted, and a refused subtree must never count as missing on the other side. Found by the Deep Scan before 4.2.5, deferred by the owner to 4.2.6 as accepted debt.	🔵	#1423

Known issues found after release

Reported against v4.2.4.

#	Area	Description	Status	Ref

Legend: 🔴 confirmed · 🟡 investigating · 🔵 planned / idea · 🟢 done / fixed (pending release) · ✅ released · ⏳ waiting on an outside step (see the row's note)

Difficulty of a requested row (the colored square, not the status dot): 🟥 hard · 🟧 moderate · 🟨 light

[bratushkadan]

Hello @axpnet !

I hope it's an appropriate way to report the issue (as according to the table there's no respective Issue created).

I can confirm issue (Requested) #55 in the table above can be reproduced with the SFTP remote:

Screenshots

If I go 1 level up the directory I am trying to sync AeroSync will begin showing me file differences (although there's none, I manually checked the SHA256's, the timestamps and the filesizes, and they all are equal both on local and remote), and if I am trying to sync the local/remote AeroSync DOES sync them.

Here's the log of dry run: aerosync-dryrun-2026-10-20T20-24-18.json

[axpnet]

Anthropic OSS Scanner: enrollment files on main, enrolment PR under review

Post-4.2.4 follow-up, done on main, shipping in v4.2.5 (#1319).

The repository now carries everything Anthropic's OSS Scanner needs to build and audit AeroFTP: a pinned, offline-ready build image and a scanner-facing threat model that defers to docs/THREAT-MODEL.md as the source of truth. The enrolment pull request anthropics/oss-scanner#935 is open with all checks green (CLA signed, terms accepted, project-builds passed); merge there is decided by Anthropic.

Area	Description	Status	Ref
Build image	.oss-scanner/Dockerfile: Ubuntu 24.04, Node 24, Rust 1.97.1 (the rust-toolchain.toml pin), Tauri Linux dependencies, cargo fetch --locked then --frozen build, every library test compiled, focused credential/grant smoke regressions fail setup on error	🟢 done	01e27235c
Context hygiene	.oss-scanner/Dockerfile.dockerignore: developer-only data, .env and local build outputs stay out of the build context	🟢 done	01e27235c
Threat model	.oss-scanner/threat_model.md: trust boundaries, untrusted inputs, priority code areas including our vendored patches and Proton native, severity guidance, dedup against RR-01..RR-12	🟢 done	01e27235c

Verified green: full PR CI (clippy -D warnings, Rust test suite, tsc, i18n validate, security-regression, build-and-release on Linux, macOS and Windows), plus Anthropic's own tools/check aeroftp end-to-end against main (anonymous clone, image build, scanner tools layer, offline start) in about 13 minutes against the 45-minute budget.

[axpnet]

webpki stack bumped for RUSTSEC-2026-0381 / 0382 / 0383

Post-4.2.4 follow-up, fixed on main, shipping in v4.2.5 (#1320).

Hours after the 4.2.4 tag, three RustSec advisories landed on the locked webpki stack and turned cargo audit red on main (distrusted emSign intermediates: bundled root programs could still trust them, and certificate verification could accept distrusted intermediates). Cargo.lock-only bump, no code changes.

Crate	From	To	Advisory	Status	Ref
rustls-webpki	0.103.15	0.103.16	RUSTSEC-2026-0382	🟢 fixed	4d87827ca
webpki-roots	1.0.9	1.0.10	RUSTSEC-2026-0381	🟢 fixed	4d87827ca
webpki-root-certs	1.0.9	1.0.10	RUSTSEC-2026-0383	🟢 fixed	4d87827ca

Verified green: cargo audit exit 0 against the current advisory DB locally, full PR CI (clippy, Rust tests, tsc, i18n validate, three-OS builds), and the Checks workflow on main is green again after the merge.

[axpnet]

Security contact email in SECURITY.md

Post-4.2.4 follow-up, done on main, shipping in v4.2.5 (#1321).

SECURITY.md now lists dev@aeroftp.app next to GitHub Security Advisories as a reporting channel. This is also the primary_contact of our Anthropic OSS Scanner enrolment (anthropics/oss-scanner#935): the enrolment triage had no in-repo email to cross-check it against, and now it does.

Area	Description	Status	Ref
Disclosure policy	One-line addition in the Reporting a Vulnerability section	🟢 done	2a1e45eb9

Verified green: PR CI (docs-only change, no code paths touched).

[axpnet]

AeroSync Compare: shared remote folders and already equal files

Post-4.2.4 follow-up, fixed on main, shipping in v4.2.5 (PR #1322, reported by @bratushkadan in the original report).

Compare could report shared folders as local-only, omit empty remote folders and recopy equal files when an older baseline disagreed with both current copies. The fix is merged as 10e647da2. Requested 55 is now recorded in queued row 4; dedicated issue #1323 stays open with the fixed | tbc label for confirmation on the reporter's original SFTP server.

Area	Description	Status	Ref
Remote folders	Provider Compare retains shared and empty folders, including S3 implicit parents, while preserving scan limits, exclusions and incomplete-scan guards.	🟢 fixed	10e647da2
Equal files	Current converged pairs no longer become differences solely because both changed since an older baseline. Strict checksum and file/directory conflicts remain actionable.	🟢 fixed	10e647da2
Encrypted names	Typed rclone decoding preserves directory names across filename modes and directory-name settings.	🟢 fixed	10e647da2
Unsettled uploads	The baseline marker left by a file changing throughout upload cannot be bypassed by matching size and time. The regression checks that local and remote bytes really differ.	🟢 fixed	10e647da2
Reporter confirmation	Retest the original folder pair and its parent on a build containing the fix, with zero dry-run actions for an equal tree.	🟡 TBC	#1323

Verified green: full PR CI on 39d2f139e before squash merge, including Linux validation (clippy, Rust suite, typecheck and i18n validation), security regression checks and Linux/Windows/macOS Intel/macOS ARM builds, native Windows unit tests, Checks and DCO. The CI follow-up also passed 268 focused local tests (3 existing ignored oracle/scout tests), Rust formatting and clippy with warnings denied. Validation on the reporter's original server is still pending; the fix is not in the published v4.2.4.

Legend: 🔴 confirmed · 🟡 investigating · 🔵 planned / idea · 🟢 done / fixed (pending release) · ✅ released

[axpnet]

Recursive uploads preserve literal Unix backslashes

Post-4.2.4 follow-up, fixed on main, shipping in v4.2.5 (PR #1324, commit 4cc380297).

On Unix, put -r treated a filename backslash as a Windows directory separator. back\slash.txt could therefore target the same destination as back/slash.txt, skipping a file or overwriting a different nested file. The shared recursive upload planner now normalizes only the host platform's native separator, preserving distinct Unix names while retaining Windows path conversion.

Area	Description	Status	Ref
Recursive upload	Literal backslashes in filenames and directory names remain distinct from real nested paths.	🟢 fixed	4cc380297
Command regression	put_recursive_preserves_literal_backslashes_in_unix_names drives the real command with four distinct files, pooled and single-session providers, and normal, immutable, no-clobber and files-from modes.	🟢 passed	#1324
Independent local reproduction	The installed 4.2.4 Directory-provider upload returned exit 0 with only 2/4 files and an overwritten nested file; the corrected build preserves 4/4 names and SHA-256 values.	🟢 verified	4cc380297
Proton correctness	On each API and CLI profile, the patched debug build uploaded 17 special-name files plus 4 collision-fixture files. Independent readback through the installed native API CLI confirmed all 42 filenames and SHA-256 values.	🟢 verified	#1324
Related sync/watch/GUI class	A local Directory sync --dry-run still collapses four files into two plan rows, including with this put-only patch. Shared/local GUI scans and frontend write-path equivalents need a separate correction.	🟡 investigating	Requested 72

Verified green: Rust formatting and diff checks; cargo test --locked --bin aeroftp-cli put_recursive_ -- --nocapture (9 passed, 0 failed); exact-name/SHA-256 correctness checks above; full PR CI on 37873f953 before squash merge, including Linux validation, Windows native unit tests, Linux/Windows/macOS Intel/macOS ARM builds, all three-OS CLI smoke checks, Checks, DCO and automated review. The fix is on main and is not part of the published v4.2.4. These correctness checks make no throughput or cross-provider performance claim.

Legend: 🔴 confirmed · 🟡 investigating · 🔵 planned / idea · 🟢 done / fixed (pending release) · ✅ released

[axpnet]

Literal Unix paths remain distinct through sync, watch and the GUI

Fixed on main, queued for v4.2.5 (PR #1325, merge 917ef97a4).

A literal backslash in a Unix filename could be rewritten as a directory separator outside recursive put, collapsing separate files in scans or sending frontend operations to the wrong path. The scoped repair extends exact path preservation through sync/watch, local GUI scans, transfer/restore adapters, navigation, picker staging and editor identity.

Area	Description	Status	Ref
Native and frontend path identities	Keep a filename backslash distinct from an actual nested path; preserve Windows native drive and UNC behavior and opaque remote names	🟢 fixed on main	917ef97a4
Parent directories	Prepare the complete remote ancestor chain and stop affected uploads on real parent-creation failures	🟢 fixed on main	#1325
Exclusion reachability	Reach an explicitly re-included escaped-name child while pruning unrelated excluded directories	🟢 fixed on main	#1325
Remaining correspondence/format work	Canonical Unicode matching stays under #1326; vault/backup representations and provider-specific grammar contracts are not certified by this patch	🟡 separate follow-up	#1326, Requested 72

Validation includes real Directory sync/write/update and DEV GUI path receipts, regression coverage for independent literal/nested names, POSIX double-root versus UNC boundaries, real AeroCloud ignore scans, Windows roots and parent-creation failures. This is correctness evidence, not a new throughput benchmark.

Verified green: complete GitHub PR CI on dee069509891390efd6f1489a0038bba0f7491a7, including Linux validation, Linux/Windows/macOS Intel/macOS ARM builds, native Windows unit tests, CLI smoke, Delta Sync Integration, Portal file chooser, Checks, DCO and review/security checks. The merged commit is 917ef97a4eafcd6bf556d62ed083e026228cda9a. No new version has been released.

[axpnet]

Canonical Unicode names retain exact object identities

Post-4.2.4 follow-up, fixed on main, shipping in v4.2.5 (PR #1328, merge 2a5c5ed7d).

AeroSync can now pair uniquely corresponding NFC/NFD names without rewriting either side's filesystem paths. Danila Bratushka (@bratushkadan) contributed the canonical pairing and per-side path propagation in #1329, and retains co-author credit. Integration review also found and corrected cases where a watcher borrowed another file's identity, a baseline update erased an independent twin, or a fast rename moved the wrong literal remote object.

Area	Description	Status	Ref
Compare and navigation	Exact names win; canonical fallback requires unique correspondence. Plain SFTP navigation resolves destination directory spellings from actual listings.	🟢 fixed	#1328
Watcher and rename	Occupied legacy aliases and ambiguous parents wait for the full scan. Mapped renames use the identity-aware transfer path.	🟢 fixed	2a5c5ed7d
Baseline and resume	Carry the selected baseline key through execution and the signed journal. Preserve independent twins and a landed download that reuses a retired local name, without per-file full-index NFC scans.	🟢 fixed	2a5c5ed7d
Original macOS/SFTP confirmation	The contributor verified their earlier build; the final integrated build still needs confirmation on the original pair. Issues #1326 and #1323 remain open.	🟡 pending retest	#1326, #1323

Verified green: all ten GitHub PR workflows on 67234d71d5cef36b3ef7ca58f3d1f8ce670ba7a7, including Linux validation, Linux/Windows/macOS Intel/macOS ARM builds, native Windows unit tests, CLI smoke on three operating systems, Proton Native, Aerorsync protocol and standalone lanes, Delta Sync Integration, Portal file chooser, Checks and DCO. Snyk and CodeRabbit checks passed and review findings were resolved. Focused local validation: 149 frontend tests, 95 Rust tests passed with one existing ignored, TypeScript typecheck, Rust formatting and Clippy with warnings denied. No fresh macOS GUI retest or performance benchmark is claimed. The fix is pending v4.2.5 and is not in published v4.2.4.

Legend: 🔴 confirmed · 🟡 investigating · 🔵 planned / idea · 🟢 done / fixed (pending release) · ✅ released

[axpnet]

Compatible dependency updates are on main

Post-4.2.4 follow-up, fixed on main, shipping in v4.2.5 (#1330).

The open compatible bumps from the 18-21 October radar are in the lockfile. The eMudhra webpki fixes were already on main in #1320, so this change does not touch them. No manifest pin moved.

Area	Description	Status	Ref
Crypto	aws-lc-rs 1.18.1 to 1.18.2, with aws-lc-sys 0.46.0. The release rejects non-canonical Ed25519 public keys in the C decoder, zeroizes ChaCha20-Poly1305 key material, and fixes an illegal-instruction crash in ML-KEM feature detection on AVX2 CPUs without BMI2.	🟢 fixed	913e0b0d9
HTTP/2	h2 0.4.19 to 0.4.20.	🟢 fixed	913e0b0d9
Archives	zip 9.0.4 to 9.0.5, sevenz-rust2 0.24.0 to 0.24.1 (adds lzma-rust2 0.23.0 beside the 0.22.0 copy zip still uses), zstd 0.14.2 to 0.14.3 with zstd-safe 8.2.0 and zstd-sys 2.1.2. The older zstd 0.13.3 copy from aerovault stays.	🟢 fixed	913e0b0d9
Runtime	tokio 1.53.3 to 1.54.1, libc 0.2.190 to 0.2.191, open 5.4.4 to 5.4.5.	🟢 fixed	913e0b0d9

No live transfer against a real server was run for this lockfile bump. The coverage is compile and unit tests, not a provider session.

Verified green: before push, cargo fmt --check and cargo test in the worktree (library 6389 passed, 0 failed, 40 ignored, plus the bin suites at 0 failed) and cargo audit with 0 vulnerabilities. PR CI then passed on 6f0b86317: Format, audit and unit tests, clippy and the mock suite, proton-native, Windows cross-OS unit tests, aerorsync standalone on Linux, Windows and macOS, and release builds for Linux, Windows, macOS Intel and macOS ARM.

[axpnet]

Requested rows are now in three tables under the same heading: Features and ideas, Non-blocking fixes, Higher-severity defects. Row numbers are unchanged, so "Requested 71" still means that row. The colored square is difficulty, not severity, and is now in the legend: red hard, orange moderate, yellow light.

[axpnet]

FTP resume and range reads keep their offset on strict servers

Post-4.2.4 follow-up, fixed on main, shipping in v4.2.5 (#1331, merge 86bb1336b).

AeroFTP's suppaftp fork now sits on v12.2.1, which sends the restart offset (REST) right before RETR, after the passive data channel is negotiated. Servers that forget a REST when another command comes in between no longer silently restart a resumed download or a range read from byte 0. The fork still carries only the buffered-reply method AeroFTP needs; that API is now proposed upstream in veeso/suppaftp#206.

Area	Description	Status	Ref
Restart order	suppaftp v12.2.1 (upstream veeso/suppaftp#194) sends REST after PASV/EPSV, immediately before RETR, for resume, provider range reads and parallel range windows	🟢 fixed	86bb1336b
Refused offset	A server without restart support (502/504) now reports NotSupported, so the CLI range hash falls back to a whole download; 550/553 stay file errors; any other refusal stays retryable and names the byte offset instead of reading like a refused download	🟢 fixed	86bb1336b
Fork scope	Pinned to 9aaa0002 (v12.2.1 plus one method, its rustdoc and two tests) under an annotated tag	🟢 done	#1331
Follow-ups	Whole-file fallback for resume and segmented downloads without REST, CR/LF names refused before PASV, active-mode and harness gaps in the new tests	🔵 planned	Requested 73, 74, 75

No live run against an external FTP server was made for this change; the coverage is strict-server loopback fixtures (exact bytes, command order, refused offsets without RETR or destination changes) and a per-status classification table.

Verified green: cargo test --lib restart_contract_tests 3 passed and cargo test --lib providers::ftp 119 passed (2 ignored) on the final head, cargo fmt --check, and full PR CI on b9e4ccbf8: Linux validation (clippy, Rust suite), Windows native unit tests, Linux/Windows/macOS Intel/macOS ARM builds, CLI smoke on three systems, FTP MLSD, Delta Sync Integration (after a rerun of an apt mirror timeout), Aerorsync, Proton native, Checks, DCO, CodeRabbit with no findings on the final head.

[axpnet]

English written in the code is now translated in every language, and the former-English ledger keeps squashed strings

Post-4.2.4 follow-up, fixed on main, shipping in v4.2.5 (#1333, merge d2b6109fb).

Many screens still showed English in every language: labels, card titles, badges, tooltips, placeholders and screen-reader labels written straight into the components. The i18n test only saw English placed next to a translated string, so these passed. The test now finds them, and every one it found is translated into the 46 other languages. The same PR fixes the former-English gate, whose ledger rebuild dropped strings that only a squashed branch had ever held.

Area	Description	Status	Ref
AeroAgent	Coding cards (patch, restore, git, checks, search, diagnostics, plan), chat, terminal and AI settings: computed card titles, actionLabel(), status words, plural tails such as {n} file{n === 1 ? '' : 's'}; 131 new keys	🟢 fixed	d2b6109fb
Connection and settings	Provider help texts with {provider} placeholders, field labels, badges, the SourceForge SSH key hint, home card relative times, providers dialog, settings, About; 63 new keys. The endpoint placeholder lost an Italian "es." it showed in English	🟢 fixed	d2b6109fb
Dialogs, panels and views	Duplicate finder, password reset dialog and its errors, transfer plan, vault, sync, trash managers, GitHub and GitLab browsers, viewers, sidebars; 163 new keys. The AeroVault overlay tooltip was Italian in every language	🟢 fixed	d2b6109fb
Plurals and placeholders	Counts use singular/plural key pairs ("1 files" and "error(s)" are gone), variable parts are {placeholders}, never concatenation; about 80 existing keys reused	🟢 fixed	d2b6109fb
Older strings	The new translations brought to light stripped accents in fr, is, tr, fi and pl strings and Macedonian words written with a Latin è, now corrected; six diacritic hits recorded as correct with their reason	🟢 fixed	d2b6109fb
JSX test	noEnglishBesideTranslation.test.ts now reports JSX text anywhere, a variable or module function that renders English as a child, and the title, placeholder, aria-label, alt and label attributes. Product, provider, protocol and cipher names and sample values are allowed by file and exact text, with a stale-entry check	🟢 fixed	d2b6109fb
Former-English ledger	i18n-stale-english.mjs --write now adds what git history holds to the committed ledger instead of replacing it, so a string from a squash-merged branch (vault.repairDryRunNoDamage, from #1273) survives the next rebuild	🟢 fixed	d2b6109fb

#	Proof	Where	Result
1	Extended JSX test on the components before the fix	local, whole tree	fails with 419 hits
2	Same test after the fix	local and PR CI	passes, about 6 s against the unchanged 30 s timeout
3	New --write self-test on the previous script	temporary git repo	fails: the ledger-only entry is lost
4	Same self-test after the fix	local and PR CI	passes
5	--write on the real tree	local	ledger unchanged apart from its comment; a second run is byte-identical

Not covered by the test, and stated in its comment: a property of an object, a value held in React state or props, a string from another module, and abbreviations made only of single letters such as "e.g.". No live GUI pass was run on the translated screens; the coverage is the scan, the component tests and the locale gates.

CodeRabbit skipped the PR (160 files, over its 100-file limit); the review outside it is on the PR: every new t() key exists, placeholders match English in all 46 locales, and every new useTranslation() sits at the top of a component.

Verified green: npm run typecheck; npm run test:unit 271 files and 2487 tests plus 14 node tests; npm run build; i18n:validate 6195 keys, 46/46 locales, 0 [NEEDS TRANSLATION]; i18n:diacritics, i18n:untranslated, i18n:contamination, i18n:stale-english and their self-tests; provider inventory, version sites, AppStream and connection manifest checks; full PR CI on 7cef12a9f: Linux validation, Format, audit & unit tests, Linux/Windows/macOS Intel/macOS ARM builds, portal checks, DCO.

[axpnet]

CI: the apt install survives a slow mirror, and its archive cache is saved even when the install fails

Post-4.2.4 follow-up, fixed on main, shipping in v4.2.5 (#1332, merge 0a3e15eaa). CI only, no change to the app.

On 2026-10-22 the Ubuntu mirror served some CI runners the 74 MB WebKit/GTK build stack at 43-170 kB/s while others in the same hour got 7 MB/s. Delta Sync Integration failed its install after two 300 s attempts on main 913e0b0d9 (run 39794879996, rerun included) and on #1331 (run 39815053371); Aerorsync Protocol was cancelled at its 30-minute job cap after 1801 s in an unbounded apt (run 39788705535). All the lanes that install this stack now use one shared action.

Area	Description	Status	Ref
Cache saved on failure	The old actions/cache saved from a post step that runs only on success, so every red job threw its download away and the lane whose apt kept failing never had an entry. The action saves right after the install, also when it failed, partial downloads included, so a rerun resumes	🟢 fixed	0a3e15eaa
One bounded attempt	apt 3.2 already resumes a cut download (Range with If-Range, answered 206, reproduced locally), so two 300 s attempts bought nothing over one. One attempt now owns a 720 s budget inside the 13-minute step; later attempts only for fast apt errors, at most three	🟢 fixed	0a3e15eaa
Named failure	A failure says which it is: mirror too slow (with MB and kB/s), apt error, or budget spent by the restore before apt started (CodeRabbit), instead of a job cap cancelling an unnamed step	🟢 fixed	0a3e15eaa
Complete before partial	Keys record whether the install completed. Two lookups, complete on every ref first and a partial only when none is visible, because GitHub tries every key on the PR ref before main (CodeRabbit). On the PR's first run two slow lanes had saved 23 and 34 MB partial sets over three complete 69-70 MB ones	🟢 fixed	0a3e15eaa
Lanes and caps	Delta Sync Integration (2 jobs), FTP MLSD (2, same loop), Aerorsync Protocol (3). Aerorsync job caps 30 to 45 minutes: those jobs already took 24-27, so the bounded apt step, not the cap, now names a slow mirror. cli-smoke, nightly telemetry, proton-native and portal-chooser unchanged (installs topped at 3-7 minutes under loose caps)	🟢 fixed	0a3e15eaa

#	Scenario	Where	Result
1	Install on a slow mirror, first push, cold cache	PR CI, 2 lanes	named "mirror too slow" error at 37 and 54 kB/s, 24 and 34 MB kept as partial sets
2	Restore order on the final head, a newer 18 MB partial set present	PR CI on 1587ae9b1, 7 jobs	all 7 restored a complete- set; installs in 33-82 s
3	Slow mirror with a warm cache	PR CI, key-auth lane	1 MB still missing, fetched at about 6 kB/s in 238 s, lane green
4	Script paths: success, apt error, budget timeout, budget spent before apt, step killed by its cap, unreadable partial/	local shim simulation	each ends with the expected exit code, message and cache kind

Known limit, tracked as Requested 76: the Actions cache is saturated (10.14 of 10 GB, 10 entries, the GB-sized Rust caches) and an apt entry is evicted within half an hour (run 39827742722: restored at 18:42 UTC, gone at 19:13). Until that is addressed, a lane that runs after a quiet half hour starts cold and falls back on the bounded install. actionlint and shellcheck were not run; the proof is the PR CI.

Verified green: cargo fmt --check, npm run typecheck, i18n:validate, i18n:diacritics, i18n:untranslated, provider inventory, npm run test:unit 271 files and 2486 tests; full PR CI on 1587ae9b1: Checks, DCO, Delta Sync Integration, FTP MLSD listing, Aerorsync Protocol (check, deflate oracle, lane 3), Linux validation, Linux/Windows/macOS Intel/macOS ARM builds.

[axpnet]

Proton Drive CLI mode reaches its native bulk from relative paths, sync trees, --no-clobber and MCP

Post-4.2.4 follow-up, fixed on main, shipping in v4.2.5 (#1334, merge dcaba8688).

The native bulk shipped in 4.2.4 (#1317) moved Proton Drive CLI mode from one proton-drive process per file to one per folder, but only on some of the paths that reach it. A review of the released code and a live run of the 4.2.4 binary showed that the most common command forms never used it, and that a few edge cases failed a whole group. This closes those gaps.

Area	Description	Status	Ref
Relative paths	put -r ./dir, get -r <remote> ., glob put ./*.json and sync ./local/ are planned and passed in their absolute spelling. In 4.2.4 every relative path ran one process per file	🟢 fixed	dcaba8688
Sync trees	The CLI sync plan comes out of a hash map, so a tree interleaved its folders and a planner that grouped only adjacent files made single-file groups. Files of one folder are now gathered when every destination in the batch is distinct; with a repeated destination the adjacent-only plan stays, so the last write is still the caller's	🟢 fixed	dcaba8688
Command-line budget	Each file counts only the side that reaches the command line, against 96 KiB outside Windows (24 KiB on Windows, as before). 200 files of a deep local folder now take one launch instead of two	🟢 fixed	dcaba8688
--no-clobber and --immutable	put -r and glob put on a bulk-capable provider decide existence with one listing per remote folder, with the per-file rules, then use the bulk. 4.2.4 ran one stat per file	🟢 fixed	dcaba8688
MCP aeroftp_upload_many	Plain local files that share a remote folder go up in one native call through an optional RemoteBackend::upload_bulk, one result per item in the same JSON, no_clobber with one listing per folder	🟢 fixed	dcaba8688
Partial groups	New NotAttempted outcome. An item the adapter cannot carry, or one the transport failed (429, 503, timeout, dropped connection), runs once on the single-file path instead of failing its whole group or ending the command. An upload whose outcome is unknown is never replayed	🟢 fixed	dcaba8688
Download integrity	The planned size is no longer compared: without claimedSize Proton lists the encrypted size, so 4.2.4 refused correct files on every run. The fresh listing's claimed size is enforced, on top of the SDK's per-block SHA-256 and manifest signature checks	🟢 fixed	dcaba8688
CodeRabbit finding	A claimed-size mismatch was a retryable local error and could reach the single-file path, which published it unchecked. It is final now, and a file the bulk hands back is held to the claimed size there until it is published	🟢 fixed	dcaba8688
Staging folders	Local scans and the file watcher skip .aeroftp-proton-bulk-* and .aeroftp-proton-dl-*, so AeroCloud or a second sync never uploads a download in progress	🟢 fixed	dcaba8688
Proton sections	mkdir on a section such as /my-files answers "already exists", so a sync conflict-rename upload no longer stops at the section (a regression that was on main only, never released)	🟢 fixed	dcaba8688

Live tests, Proton test account, one serial run of each binary (4.2.4 release, then a debug build of the branch), 200 distinct 4 KiB files and an 80-file tree in five folders, downloads compared byte for byte. The generated remote tree went to the Proton trash afterwards.

#	Scenario	Where	Result
1	put -r, 200 files, absolute path	Proton, CLI mode	25.4 s, 1 launch (4.2.4: 42.6 s, 2)
2	put -r ./dir	Proton, CLI mode	26.5 s, 1 launch (4.2.4: 115.9 s, 200)
3	get -r to an absolute path	Proton, CLI mode	27.2 s, byte-identical (4.2.4: 29.4 s)
4	get -r into .	Proton, CLI mode	22.1 s, byte-identical (4.2.4: 122.6 s, 200 launches)
5	put -r --no-clobber, all 200 already present	Proton, CLI mode	14.7 s, 2 listings, exit 9, 200 skipped (4.2.4: 88.6 s, 204 info)
6	sync upload, 80 files in 5 folders	Proton, CLI mode	33.5 s, 5 launches (4.2.4: 70.0 s, 80)
7	sync download, same tree	Proton, CLI mode	37.7 s, 5 launches, byte-identical (4.2.4: 66.6 s, 80)
8	sync --direction both right after	Proton, CLI mode	no transfer, no replan
9	Ctrl+C during a bulk upload and a bulk download	Proton, CLI mode	exit 130, no child process left, staging removed, nothing half-published

On the same account the official CLI took 26.8 s up and 18.3 s down, and the native client 24.5 s and 26.5 s. These are single whole-command samples, not repeated medians. MCP aeroftp_upload_many was not tested live: the debug build reads the development vault, which holds no Proton profile; its bulk path is covered by 7 unit tests.

Still open, now Requested 77 to 79: AeroSync in the GUI and AeroCloud still transfer one file at a time; a first sync into a remote folder that does not exist yet ends partial with exit 4 although every file went up; Proton native mode roots / at My Files while CLI mode roots it at the sections, so /my-files/x lands in /my-files/my-files/x in native mode.

Verified green: 24 new regression tests, each seen failing against the 4.2.4 behaviour or with its defence removed; cargo test --lib 6407 passed and cargo test --bin aeroftp-cli 875 passed before the claimed-size changes, then the 709 bulk, Proton, sync, scan, transfer DAG and MCP tool tests after them; cargo clippy --all-targets -- -D warnings, cargo fmt --all -- --check and aeroftp-cli inventory --check; full PR CI on b3b5ad010 across Linux, Windows and macOS x64/ARM, CodeRabbit with no open finding on the final head.

[axpnet]

scrivo ora

[axpnet]

Internal v4.2.3 notes removed from the public documentation

Fixed on main, shipping in v4.2.5 (#1381).

Three dated triage and verification notes were published in the documentation by mistake. They are removed from the public tree; private working copies and the Git history preserve the records.

Area	Description	Status	Ref
Public documentation	Remove V423-REQUESTED-TRIAGE.md, V423-PROFILE-PREFERENCES.md and V423-LINUXDEPLOY-PINS.md; retained tracked files do not reference them	🟢 fixed	6b7a0162f

Verified green: required GitHub Checks and DCO; CodeRabbit reported no actionable comments. This was a documentation-only deletion; no runtime or live-provider test is claimed.

[axpnet]

Compatible dependency bundle for v4.2.5

Done on main, shipping in v4.2.5 (PR #1387, 9a8112f55).

The five compatible Dependabot updates are consolidated into one reviewed bundle. Both TLS trust stores now include the removal of emSign Root CA - C1 and emSign ECC Root CA - C3.

Area	Description	Status	Ref
TLS roots	webpki-roots and webpki-root-certs 1.0.11	🟢 done	9a8112f55
Frontend	Vite 8.3.5 and react-window 2.5.0	🟢 done	#1387
Rust dependencies	uuid 1.29.0 and unicode-normalization 0.1.26, including resolver edge changes carried by the source lockfiles	🟢 done	#1387
Consolidation	PRs #1382, #1383, #1384, #1385 and #1386 closed with comments pointing to the bundle	🟢 done	#1387

Verified green: required GitHub Actions checks, including Linux, Windows and macOS builds, unit and integration lanes, DCO and security checks, on 083d9c0c3. CodeRabbit reviewed the final head with no actionable comments; lockfiles excluded by its path filters were inspected separately during bundle preparation. No dependency holds were changed.

[axpnet]

CLI checksum checks compare both sides

Fixed on main, shipping in v4.2.5 (PR #1388, 952752600).

check --checksum could report different same-size contents as a match because only local hashing was enabled. The plain-path scan now requests remote hashes too. Comparable SHA-256 digests drive content comparison; unsupported comparable digests and crypt overlays retain the documented size fallback, exposed per pair as compare_method in JSON.

Area	Description	Status	Ref
CLI check	Requests local and remote checksum collection together	🟢 fixed	952752600
Regression	Different same-size contents fail comparison; size-only and equal-content controls remain valid	🟢 verified	#1388

Verified green: regression observed red without the fix and green with it; formatting and required GitHub Actions checks on Linux, Windows, macOS aarch64 and macOS x64. CodeRabbit reviewed the exact head with no actionable findings. This row does not declare the separate release dependency audit complete.

[axpnet]

Crypt connections keep their configured landing

Fixed on main, shipping in v4.2.5 (#1390, merge d6552d74c).

Connections open directly at the resolved Remote Path. A landing above a separate encrypted scope stays in plaintext until that folder is entered, preserving the root-landing behavior from #1211.

Area	Description	Status	Ref
Connection landing	Saved and Quick Connect paths resolve username templates and retain their actual starting directory without visiting the encrypted island first	🟢 fixed	d6552d74c
Reconnect state	Reset frontend vault mirrors and the stable reload sentinel before arming the new profile owner	🟢 fixed	d6552d74c
Filen Refresh	Position the provider at the outside-scope landing and reuse its response so Refresh keeps that directory	🟢 fixed	d6552d74c

Verified green: 55 focused Crypt tests and TypeScript noEmit; stale-vault, reload and outside-scope Refresh regressions were observed red before their fixes. CodeRabbit reviewed exact head 2811c6740 with no actionable findings and all threads resolved. All required CI passed, including Linux validation and packaging, Windows packaging, both macOS architectures, Checks and DCO. Merge and branch/worktree cleanup are verified; generated build artifacts are preserved locally.

The subsequent release-review corrections for failed scope-entry recovery and unavailable OAuth landing paths are prepared separately in #1391, pending its review and CI.

[axpnet]

AeroFTP 4.2.5 preparation and public documentation alignment

Fixed on main, pending release in v4.2.5 (#1391).

The release preparation aligns all version declarations and public repository documentation with the implementation. It also brings the published AeroVault0.6.7 dependency into the application and completes the reviewed Crypt activation/navigation ownership fixes. This preparation merge does not publish the release: final pre-tag audit, the remaining security work, synchronized documentation deployment and complete CI on final main remain required.

Area	Description	Status	Ref
Version and documentation	Version4.2.5 across manifests, AppStream, splash and packages; public CLI/MCP schemas, transfer/provider contracts, approval and credential boundaries, privacy, vault recovery and product guides reconciled with source	🟢 done on main, pending release	477b81a7d, #1391
Crypt recovery	Connection/activation ownership crosses secret reads, arm/apply/re-anchor and UI publication; scoped rollback preserves newer attempts, transport generation and the original error; navigation takeover settles only its own log and decryption state	🟢 fixed	477b81a7d
Dependencies	Consume published AeroVault0.6.7, removing the old zstd0.13/zstd-safe7 dependency path	🟢 fixed	477b81a7d
Validation boundary	Full all-platform PR CI passed on final head1f497d680. Maintainer approved the final two Markdown-only corrections after source verification; the last full CodeRabbit review covered the identical runtime on2d6, while its subsequent full-review request remained rate limited	🟢 preparation verified; final release gates pending	#1391

Verified green: complete runtime release gate7,855 unique Rust tests with100explicit exclusions (6,772library+949binary+134integration;40library+58integration+2doc ignored), strict Cargo audit of1,247dependencies without added ignores, fmt/i18n/default and bothall-features Clippy variants. Latest changed frontend passed2,771tests/294files+14Node fixtures and32focused registry/tool tests, typecheck/security/version/AppStream checks. Later Rust edits were two verified prose literals, followed by Markdown-only corrections; unchanged component results are reused through archived equality proofs. Final two Markdown changes passed fresh version/AppStream/diff checks. The squash merge tree is byte-identical to the validated final PR tree. Main's new CI must complete before tagging.

The final pre-tag audit is still open. No release tag or distribution publication is claimed by this entry.

[axpnet]

Remote download names stay inside the selected local directory

Fixed on main, pending release in v4.2.5 (#1392).

Remote leaf names are validated before constructing local destinations or running download preflight. The guard covers the real single-file, folder, batch and queued retry paths and follows destination-platform separator rules, preserving valid POSIX names containing a literal backslash.

Area	Description	Status	Ref
Destination validation	Reject unsafe remote leaf names before local path construction and writers	🟢 fixed on main	28c61059a
Compatibility	Windows destination separators remain blocked; literal POSIX backslashes remain valid	🟢 verified	#1392
Review and CI	Internal Claude review PASS on exact head c1587ba; applicable PR CI complete with10SUCCESS/5expectedSKIP and CodeRabbit neutral for quota	🟢 verified before merge	#1392

Verified green: Lion independently ran34 focused tests exercising production download/batch closures and boundary cases plus typecheck on the exact PR head. Claude read the production guard and call sites and reused these unchanged-code results rather than duplicating the suite. Tests use mocked IPC, not live provider data. The merged commit is verified on main; combined release validation and final pre-tag audit remain pending. Additional Win32 reserved-name/ADS behavior is outside this scoped traversal fix and was not live-tested.

[axpnet]

S3 copies and AeroCloud preserve the saved encryption policy

Fixed on main, pending release in v4.2.5 (#1393).

Single-request S3 server-side copies apply configured upload-policy headers before SigV4 signing, and the AeroCloud connection passes the saved SSE mode and KMS key identifier. The shared policy also includes configured ACL and storage class and retains the existing MegaS4 exclusion. Multipart copies already apply the policy when initiating their upload.

Area	Description	Status	Ref
CopyObject	Destination policy headers are included before the signing step	🟢 fixed on main	3eb1107e8
AeroCloud	Production connection closure forwards both saved SSE fields	🟢 fixed and focused-tested	#1393
Review and CI	Internal Claude source review PASS on exact head6e1510048; applicable PR CI14SUCCESS/7expectedSKIP, CodeRabbit neutral for quota	🟢 verified before merge	#1393

Verified green: Lion independently ran the actual AeroCloud connection-closure wiring regression on the exact PR head; Snow reports164 S3 tests passed with4 live cases explicitly ignored, plus typecheck/build. Claude verified the CopyObject signing path, multipart initiation and saved-field wiring against source and reused unchanged validation. No live AWS KMS or SSE-C interoperability claim is made. Final combined release validation and pre-tag audit remain pending.

[axpnet]

Filen share-link creation is disabled until per-share encryption exists

Fixed on main, pending release in v4.2.5 (#1395).

Creating a Filen share link, for a file or a folder, is now refused before any listing or API call. The previous link format could expose more than the shared item, so creation stays off with no fallback until a per-share encryption scheme is proven. Revoking links that already exist keeps working.

Area	Description	Status	Ref
Provider	create_share_link returns NotSupported for files and folders before any request; capabilities report no share links	🟢 fixed on main	54f4434e8
GUI	The native Filen share action and the providers matrix entry are removed	🟢 fixed on main	#1395
Docs	PROTOCOL-FEATURES marks Filen share links unsupported in the matrix and the detailed table	🟢 fixed on main	#1395

Verified green: real-method regression with a local counting server shows zero requests for file and folder; Filen suite 74/74 and share-link 9/9 (reported by Snow); GUI gate regression RED then GREEN, tsc --noEmit clean (Claude). Applicable PR CI on the exact head 1081109c0 green, CodeRabbit neutral. Final combined release validation and pre-tag audit remain pending.

[axpnet]

Peer transport lockfile picks up the current TLS and runtime security patches

Fixed on main, pending release in v4.2.5 (#1397).

The peer transport crate keeps its own lockfile for standalone builds and checks. That lockfile now resolves the same patched TLS, certificate and async runtime versions as the application lockfile, which closes the dependency alerts that pointed at it. The application build itself uses the root lockfile, unchanged here.

Area	Description	Status	Ref
peer-l0/Cargo.lock	rustls 0.23.46, rustls-webpki 0.103.16, tokio 1.54.1, webpki-roots and webpki-root-certs 1.0.11, ctutils 0.4.6	🟢 fixed on main	67db59003

Verified green: lockfile-only change, metadata resolves with --locked --offline, cargo audit on the standalone lockfile reports no vulnerabilities and nothing unsound (three older unmaintained notices remain, no ignore added); applicable PR CI on the exact head 7d69f2316 green.

[axpnet]

S3 multipart copies refuse an oversized plan before allocating it

Fixed on main, pending release in v4.2.5 (#1399).

A server-side S3 copy of a very large object is split into parts, and S3 allows at most 10,000 parts per upload. The part count is now checked while planning, before the part list is allocated, so an impossible copy fails at once with a clear error instead of first reserving memory for the whole plan.

Area	Description	Status	Ref
Copy planner	10,000-part cap checked before allocation; the single caller propagates the error; zero-size and range math unchanged	🟢 fixed on main	fd1a6c341

Verified green: 10,001 parts rejected (seen failing before the fix), exactly 10,000 accepted, u64::MAX rejected; 8 planner tests and 167 S3 tests with 4 live-only ignored, Clippy -D warnings (reported by Snow); independent source review; CodeRabbit full review on the exact head 66523da12 with no actionable comments; applicable PR CI green.

[axpnet]

S3 requests stay on the configured endpoint, and the cleartext check follows the real request

Fixed on main, pending release in v4.2.5 (#1398).

In virtual-hosted mode the bucket name becomes part of the request host. A bucket name that could change where a signed request goes is now rejected when the profile is built, so the signature can only reach the configured endpoint. The plain-HTTP consent check now also looks at the final request URL, while a URL derived from the endpoint (including bucket.localhost behind a local endpoint) keeps the endpoint's verdict, so local MinIO setups need no new consent.

Area	Description	Status	Ref
Profile build	Virtual-hosted bucket validated as part of the endpoint host; path-style and bucket discovery unchanged	🟢 fixed on main	ca21375f1
Signing and presign	Cleartext consent checked on the final URL; endpoint-derived URLs share the endpoint's verdict	🟢 fixed on main	#1398

Verified green: delimiter rejection proven on a host-name endpoint with a positive control; local virtual-hosted signing seen refused before the follow-up fix and accepted after it; S3 suite 176 passed with 4 live-only ignored, Clippy -D warnings clean; CodeRabbit reported no actionable comments; applicable PR CI on the exact head b8d7634cc green.

[axpnet]

Internxt in-memory downloads stage decrypted data privately

Fixed on main, pending release in v4.2.5 (#1400).

When a file is read into memory from Internxt (previews, edits, CLI and MCP reads), the decrypted bytes pass through a temporary file. That file used to sit directly in the shared temporary directory with default permissions and could stay behind after a failed download. It now lives in a private directory that only the owner can enter and that is removed on success and on every error; a failed removal is reported instead of silent.

Area	Description	Status	Ref
Staging	Owner-only (0700 on Unix) temporary directory, removed with its contents	🟢 fixed on main	f26af92d3
Cleanup	Explicit close after every handle is released; a cleanup failure is surfaced	🟢 fixed on main	#1400

Verified green: the staging test was seen failing without the explicit mode (the directory came out 0775 under this machine's umask) and passes with it; a cleanup test covers all four read and cleanup outcomes; Internxt suite 42/42, Clippy -D warnings clean; CodeRabbit accepted the cleanup fix with no actionable comments on the final head 89ba5a3b9; applicable PR CI green.

[axpnet]

Credentials stay with the user who owns them

Fixed on main, pending release in v4.2.5 (#1394).

With several AeroFTP users on one device, each user's credentials now stay with that user. A locked user's secrets are refused before any shared fallback, a sign-in started by one user is saved for that user even if the active account changes meanwhile, and another user can no longer read, overwrite, delete or export the legacy owner's tokens, or the other way round.

Area	Description	Status	Ref
Copy and import	Copied users get fresh profile identities; a skipped import keeps existing secrets; a metadata-only import works without an open vault	🟢 fixed on main	1dcb419f6
Locked users	A locked partition refuses access before the shared vault, the memory cache or plaintext, also with the vault closed	🟢 fixed on main	#1394
Legacy owner	Established once and persisted: demoting or deleting admins never hands the legacy secrets to someone else	🟢 fixed on main	#1394
OAuth and Jottacloud	Tokens of other users stay in their own partition at runtime and on import; export and the rclone bridge read owner-aware; sign-ins bind to the initiating user	🟢 fixed on main	#1394
Proton	Sessions keep adopting the vault's newer pair for the same session, which fixes the Windows relocation test	🟢 fixed on main	#1394

Verified green: each defect was reproduced failing before its fix (locked owner reading plaintext with the vault closed, admin demotion moving the owner, other users' OAuth and Jottacloud tokens reaching the shared vault, Proton relocation on Windows CI); the isolated ownership regression and the Proton relocation test pass, focused suites 213 passed with 0 failed, Clippy -D warnings on lib, tests and binaries clean; CodeRabbit findings answered and accepted with no actionable comments on the final head a2fa7c7d8; applicable PR CI on all platforms green.

[axpnet]

Pre-tag commit audit: PASS, and the 4.2.5 release preparation

On main, pending release in v4.2.5 (#1401).

Every commit since 4.2.4 was reviewed in domain lanes, and every later change was counter-reviewed against its exact head before merging. All confirmed findings are fixed on main; three follow-ups are deferred to 4.2.6 by the owner and tracked as Requested 102, 103 and 104. The release preparation consumes AeroVault 0.6.8 and records the security changes in CHANGELOG and AppStream, with the release date 2026-10-28.

Area	Finding	Fix	Ref
Credentials	Cross-user OAuth and Jottacloud tokens, locked users with a closed vault, legacy owner moved by admin changes	Fixed and regression-tested	#1394
Filen	Share links exposed more than the shared item	Creation disabled, GUI and docs aligned	#1395
S3	Request authority, final-URL plain-HTTP check, copy encryption policy, oversized multipart plans	Fixed	#1393, #1398, #1399
Local files	Remote download names, Internxt plaintext staging, AeroVault temporary files and permissions	Fixed	#1392, #1400, AeroVault 0.6.8
Dependencies	Standalone peer lockfile behind the application on TLS and runtime patches	Updated	#1397
Deferred	Recursive sensitive-path checks for AeroAgent archives and MCP sync; S3 version-listing progress	4.2.6	Requested 102, 103, 104

Verified green: full local release gate on the candidate (7871 Rust tests passed with 0 failed, 2782 frontend tests, Clippy --all-features -D warnings for the library and the CLI, default Clippy, typecheck, 47 locales with 0 placeholders, cargo audit clean on 1247 crates); release PR CI green; main at 764bd0b39 has the tested tree. Main CI on all platforms and the tag follow.

[axpnet]

AeroFTP 4.2.5 released

AeroFTP 4.2.5 is out: GitHub Release with signed packages for Linux, Windows and macOS, Snap stable, AUR aeroftp-bin, SourceForge and the updated documentation at docs.aeroftp.app. The Winget update is waiting for Microsoft's validation.

All 70 queued rows above shipped and are marked released. The open requests, including the three security follow-ups deferred from the pre-tag audit (Requested 102, 103 and 104), continue with their numbers unchanged in the 4.2.6 tracker: #1424.